Suspicious Unload of Elastic Agent via Launchctl

[rule]
description = """
Detects the abnormal unload of the Elastic Agent plist via the launchctl system binary. This activity can indicate an
attempt to disable or destroy the agent's ability to continuously monitor system activity and may indicate a threat
actors attempt to evade defenses and remain undetected or not be recorded while performing actions on their objective.
"""
id = "4abdbb10-6653-4a3b-8e7a-9c4f9382f03b"
license = "Elastic License v2"
name = "Suspicious Unload of Elastic Agent via Launchctl"
os_list = ["macos"]
version = "1.0.24"

query = '''
process where event.type == "start" and 
    (
        (
            process.name == "launchctl" and
            process.args : "unload" and
            process.args like~ "*co.elastic.elastic-agent.plist"
        ) or 
        (
            (process.name in ("sh", "zsh", "bash", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
            process.args == "-c" and
            process.command_line like~ "*unload*co.elastic.elastic-agent.plist*"
        )
    ) and not 
process.parent.name == "elastic-agent" and not
process.parent.executable like~ ("/sbin/launchd",
                                 "/Library/PrivilegedHelperTools/*",
                                 "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM",
                                 "/usr/local/jamf/bin/jamf", 
                                 "/usr/bin/sudo") and not 
process.Ext.effective_parent.executable like~ ("/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
                                               "/usr/local/jamf/bin/jamf",
                                               "/usr/libexec/xpcproxy",
                                               "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
                                               "/Library/PrivilegedHelperTools/com.todyl.SGNCoreHelper", 
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                               "/Library/Elastic/Agent/data/elastic-agent*/elastic-agent.app/Contents/MacOS/elastic-agent",
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                               "/opt/jc/bin/jumpcloud-agent",
                                               "/Library/Elastic/Agent/*",
                                               "/Library/PrivilegedHelperTools/com.todyl.SGNCoreHelper",
                                               "/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent",
                                               "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                               "/Library/Endgame/esensor",
                                               "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM",
                                               "/Applications/iTerm.app/Contents/MacOS/iTerm2")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"